New Jersey Data Privacy Act (Senate Bill 332)

Comprehensive privacy legislation that applies to businesses processing personal data of New Jersey residents. Requires businesses that control or process personal data of 100,000+ consumers or derive 25% of revenue from selling personal data to provide privacy notices, respond to consumer rights requests, and implement reasonable security practices. Grants consumers rights to access, correct, delete, and port their data. Includes special provisions for processing sensitive data and protecting minors. Enforcement through Division of Consumer Affairs with fines up to $10,000 per violation.

JurisdictionNew Jersey
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The New Jersey Data Privacy Act (NJDPA) imposes several key requirements on businesses:

  • Scope: Applies to businesses that control or process personal data of at least 100,000 New Jersey consumers, or 25,000 consumers if deriving revenue from selling personal data. New Jersey Legislature - S332
  • Privacy Notices: Controllers must provide a clear and accessible privacy notice detailing data collection practices, purposes, sharing, and consumer rights. NJ Division of Consumer Affairs FAQ
  • Opt-Out Rights: Consumers can opt out of the sale of their personal data, targeted advertising, and profiling. Controllers must recognize universal opt-out mechanisms. NJ Division of Consumer Affairs FAQ

Compliance Challenges

Organizations face several challenges in complying with the NJDPA:

  • Data Mapping: Identifying and categorizing all personal data across systems can be complex. IAPP Resource Center
  • Consent Management: Implementing mechanisms to obtain and manage consumer consent, especially for sensitive data. OneTrust BlogPost

Implementation Best Practices

To effectively implement NJDPA requirements:

  • Conduct a Data Inventory: Map data flows and create a comprehensive inventory of personal data. NIST Privacy Framework

Recent Updates

The NJDPA is a new law with recent developments:

Related Regulations

The NJDPA interacts with several other privacy regulations:

  • General Data Protection Regulation (GDPR): More stringent EU regulation that influenced NJDPA. Official GDPR Text

Industry Impact

The NJDPA will significantly impact various industries:

Sources

Recent developments

  • — Analysis of the New Jersey Data Privacy Act’s effective date and operational requirements, highlighting that SB 332 (NJDPA) took effect on 2025-01-15 and now imposes comprehensive obligations on businesses handling New Jersey residents’ personal data, including robust cookie consent and transparency duties.[7] (source)
  • — Industry-focused overview explaining how NJDPA’s thresholds (100,000 consumers, or 25,000 consumers with significant revenue from data sales) are driving website and adtech changes, with businesses implementing clearer consent banners and revising tracking practices for targeted advertising and sensitive data.[7] (source)
  • — Pre-go-live compliance guidance describing the upcoming 2025-01-15 enforcement of the New Jersey Data Privacy Law, outlining required privacy notices, consumer rights (access, correction, deletion, portability, opt-out), and how organizations are updating policies and consent mechanisms in anticipation.[3] (source)
  • — Policy brief detailing implementation expectations for SB 332, emphasizing controller duties (clear privacy notices, 45-day response to rights requests, opt-out handling) and noting that many companies are aligning their New Jersey programs with other state privacy regimes to streamline multi-state compliance.[2] (source)
  • — Jurisdictional analysis confirming SB 332 as New Jersey’s comprehensive privacy framework, summarizing data subject rights and AG-exclusive enforcement, and reporting that legal and compliance teams are treating NJDPA on par with other state omnibus privacy laws in risk assessments and program design.[5] (source)
  • — Legal update on SB 332’s passage describing applicability thresholds, consumer rights, and exemptions (including GLBA entities), and noting early industry reaction that the Act closely follows the growing “standard model” of state privacy laws, easing harmonization across jurisdictions.[6] (source)
  • — Privacy-sector commentary on New Jersey’s new law, explaining controller and processor obligations and signaling that vendors and brands are beginning to map data flows and update contracts to meet NJDPA requirements ahead of the 2025 effective date.[4] (source)
  • — Law firm analysis of the New Jersey Data Privacy Act detailing broader applicability and narrower exemptions than some peer laws, the requirement for data protection assessments for high-risk processing, and exclusive AG enforcement—points that prompted businesses to reassess profiling, targeted advertising, and sensitive data practices.[1] (source)
  • — Practical overview for businesses explaining key obligations (privacy notices, consumer rights, opt-outs, enforcement fines up to $10,000/$20,000) and reflecting industry concern about increased enforcement exposure, leading many organizations to standardize privacy documentation and consent flows across states.[3] (source)
  • — Background brief on SB 332 noting New Jersey as the 13th state with comprehensive consumer privacy protections and describing how companies are expected to enhance disclosures, honor opt-outs, and build appeal mechanisms for consumer requests, with privacy tech providers positioning NJDPA modules as part of broader U.S. compliance offerings.[2] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates